PT-2026-97720 · WordPress · Events Manager
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Events Manager versions prior to 7.4.5
Description
An issue exists in the Events Manager WordPress plugin where the scope of logged-in event and location searches is not enforced when a user provides a custom
owner value. This allows a low-privileged user to access unpublished, pending, or trashed event and venue content from other accounts, which may include full street addresses.Recommendations
Update the plugin to version 7.4.5 or later.
Exploit
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Events Manager